Lethal trifecta
Named by 13 kept items in this workspace.
7 items name it under techniques and 6 under classification.key entities.
The items that name it 13
Attack requires access to private data, exposure to untrusted content, and ability to communicate externally; removing any one stops the attack.
Simon Willison's June 2025 framing: private data, untrusted content and external communication combined in one system is dangerous; found present in 98% of 100 agents rated in Adversa's AI Risk Quadrant Report.
Combination broken by domain allowlisting of network access, severing the outbound exfiltration leg while leaving the skill functional
threat model combining access to private data, exposure to untrusted content, and ability to communicate externally, enabling data exfiltration attacks
Concept (credited to Simon Willison) describing the combination of access to private data, exposure to untrusted content, and a way to exfiltrate data, all present in the vulnerable agent
Term coined by developer Simon Willison for an agent that can reach private data, takes in untrusted outside content, and has a way to send data out; combining all three creates a leak path
An agent skill is especially dangerous when it simultaneously has access to private data, exposure to untrusted content, and ability to communicate externally (Simon Willison / Palo Alto Networks, 2026).
In every workspace you can read 14
Security
All techniques in this workspace.